Network traffic processing system

Abstract

A network traffic processing device (NTPD) implements a plurality of virtual network traffic processing devices (VNTPDs), a control plane, and an NTPD manager. The plurality of VNTPDs are configured to perform respective versions of a network processing function on network transmissions, where at least two of the respective versions are different. The control plane is configured to select, for a network transmission based on a management policy, one or more of the VNTPDs to perform respective versions of the network processing function. The NTPD manager is configured to monitor results of the selected VNTPDs performing the respective versions of the network processing function and, based on the monitored results, to determine a configuration change for one or more of the VNTPDs or to control output of the network transmission.

What is claimed is: 
     
       1. A system, comprising:
 a network traffic processing device (NTPD) implemented by one or more hardware processors and configured to implement:
 a plurality of virtual network traffic processing devices (VNTPDs) configured to perform respective versions of a network processing function on one or more network transmissions, wherein at least two of the plurality of VNTPDs are configured to perform different versions of the network processing function; 
 a control plane configured to:
 select, based on a management policy corresponding to the plurality of VNTPDs, one or more of the VNTPDs to perform one or more respective versions of the network processing function on a network transmission received at the NTPD; and 
 forward the network transmission to the selected one or more VNTPDs; and 
 
 an NTPD manager configured to:
 monitor results of the plurality of VNTPDs performing the respective versions of the network processing function; and 
 based on the monitored results of the plurality of VNTPDs:
 determine a configuration change for one or more of the plurality of VNTPDs; or 
 control output of a network transmission processed by one or more of the plurality of VNTPDs. 
 
 
 
 
     
     
       2. The system of  claim 1 , wherein the network processing function is at least one of: a firewall function, an intrusion prevention function, an intrusion detection function, a load balancing function, an application delivery controller function, a routing function, a virtual private networking function, a packet encryption function, or a packet encapsulation function. 
     
     
       3. The system of  claim 1 , further comprising a provider network comprising the NTPD, and wherein the provider network is configured to:
 receive the network transmission from a remote client; and 
 forward the network transmission to the NTPD. 
 
     
     
       4. The system of  claim 3 , wherein the provider network further comprises one or more other computing devices and is further configured to forward the network transmission processed and output by the NTPD to a particular computing device of the one or more other computing devices. 
     
     
       5. A method, comprising:
 performing, by a network traffic processing device (NTPD) implemented by one or more computing devices:
 receiving a network transmission; 
 selecting, based on a management policy, one or more of a plurality of virtual network traffic processing devices (VNTPDs) to perform a network processing function on the network transmission, wherein the VNTPDs are implemented by the NTPD, and wherein at least two of the plurality of VNTPDs are configured to perform different versions of the network processing function; 
 forwarding the network transmission to the selected one or more VNTPDs; 
 monitoring results of the selected VNTPDs performing respective versions of the network processing function on the network transmission; and 
 based on the monitored results of the plurality of VNTPDs:
 determining a configuration change for at least one of the plurality of VNTPDs; or 
 controlling output of the network transmission. 
 
 
 
     
     
       6. The method of  claim 5 , further comprising receiving, by the NTPD via an administrative interface, the management policy, wherein the management policy specifies one or more rules for distributing network transmissions between the plurality of VNTPDs. 
     
     
       7. The method of  claim 6 , wherein the management policy indicates that network transmissions should be provided to the VNTPDs in a round robin manner. 
     
     
       8. The method of  claim 6 , wherein the management policy indicates that a particular VNTPD of the plurality of VNTPDs should receive a particular percentage of network transmissions. 
     
     
       9. The method of  claim 6 , wherein the management policy indicates that network transmissions having a particular format should be provided to a particular VNTPD of the plurality of VNTPDs. 
     
     
       10. The method of  claim 6 , wherein the management policy indicates that network transmissions that indicate a particular source port, a particular destination port, or both should be provided to a particular VNTPD of the plurality of VNTPDs. 
     
     
       11. The method of  claim 6 , wherein the management policy indicates that the NTPD should provide network transmissions to a particular VNTPD in response to identifying particular data in a header of the network transmissions or as a result of a deep packet inspection of the network transmissions. 
     
     
       12. The method of  claim 5 , wherein the configuration change is determined, and wherein the determining the configuration change is further based on an update policy of the NTPD. 
     
     
       13. The method of  claim 12 , further comprising receiving, by the NTPD via an administrative interface, the update policy, wherein the update policy indicates one or more rules for making at least one configuration change at one or more of the plurality of VNTPDs, and wherein the at least one configuration change modifies the respective version of the network processing function performed by the determined at least one of the VNTPDs. 
     
     
       14. The method of  claim 13 , wherein the at least one configuration change modifies the respective version of the network processing function performed by the one or more respective VNTPDs to be the same as a different network processing function performed by one or more other VNTPDs of the plurality of VNTPDs. 
     
     
       15. A non-transitory, computer-readable storage medium storing program instructions that, when executed on one or more processors of a network traffic processing device (NTPD), cause the one or more processors to:
 implement a plurality of virtual network traffic processing devices (VNTPDs), wherein at least two of the plurality of VNTPDs are configured to perform different versions of a network processing function; 
 receive a network transmission; 
 select, based on a management policy, one or more of the plurality of VNTPDs to perform respective versions of the network processing function on the network transmission; 
 forward the network transmission to the selected one or more VNTPDs; 
 monitor results of the selected one or more VNTPDs performing respective versions of the network processing function on the network transmission; and 
 based on the monitored results of the one or more VNTPDs:
 determine a configuration change for at least one of the plurality of VNTPDs; or 
 control output of the network transmission. 
 
 
     
     
       16. The non-transitory, computer-readable storage medium of  claim 15 , wherein, to implement the plurality of VNTPDs, the instructions, when executed by the one or more processors, cause the one or more processors to implement a plurality of virtual machines, wherein each of the plurality of virtual machines is configured to execute a different respective VNTPD process that implements a different respective VNTPD. 
     
     
       17. The non-transitory, computer-readable storage medium of  claim 15 , wherein, to control the output of the network transmission, the instructions, when executed by the one or more processors, further cause the one or more processors to compare the monitored results to a traffic policy of the NTPD. 
     
     
       18. The non-transitory, computer-readable storage medium of  claim 17 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to receive, via an administrative interface, the traffic policy, wherein the traffic policy specifies one or more rules for selecting results of one of the plurality of VNTPDs to output. 
     
     
       19. The non-transitory, computer-readable storage medium of  claim 18 , wherein the network processing function is a firewall function or an intrusion prevention function, and wherein the traffic policy indicates forwarding the network transmission to a device addressed by the network transmission in response to at least one of the selected VNTPDs indicating that the network transmission should be forwarded to the device. 
     
     
       20. The non-transitory, computer-readable storage medium of  claim 18 , wherein the network processing function is a firewall function or an intrusion prevention function, and wherein the traffic policy indicates forwarding the network transmission to a device addressed by the network transmission in response to all of the selected VNTPDs indicating that the network transmission should be forwarded to the device.